Given the size of the files involved, I would take a backup of all of /opt/cribl. That way you know youre not missing anything, and dont have to worry about getting a tarball when you want to recover.

In the heat of DR, any step you can skip gets you back up and running sooner. For the sake of 50mb or so, I would take the faster recovery and piece of mind of knowing its a complete backup.

Also - are you pushing your config to a remote repo? Another quick way to get back up and running on a new leader.

My preferred method is rsync of the entire /opt/cribl dir cuz disk space is cheap, rsync is fast, and I like the simplicity of full restore. No muss no fuss.

rsync -a /opt/cribl somehost:/backups/

Alternatively, you can backup /opt/cribl/local and /opt/cribl/data

You can also use the CRIBL_VOLUME_DIR environment variable to instruct Cribl to write to a specific folder of choosing leaving the default installation files alone.

For example, CRIBL_VOLUME_DIR=/foo/bar would write all configuration changes into /foo/bar which can then be backed up using your method of choice.

And as @GarethHumphriesGKC mentioned, you can also push the local Git repository to a remote server of your choosing on a scheduled basis. Version Control | Cribl Docs This is only available with an enterprise license though.